Re: [Xen-users] Strange network problem (Etch)

[Geoff Kirk <geoff.k@xxxxxxxxxxxxxxxxxxx>]

Let me try to explain what i did recently to setup some domU's behind a 
domU acting as a gateway between 2 bridges to play with shorewall.
Using the scripts here

http://renial.net/weblog/2007/02/27/xen-vlan/

i put them in /etc/xen/scripts and edited 
/etc/xen/scripts/network-multi-vlan to look like
dir=$(dirname "$0")
"$dir/network-bridge" "$@" vifnum=0
"$dir/network-bridge-vlan" "$@" vlan=2

brctl show then gives
bridge name     bridge id               STP enabled     interfaces
vlanbr2         8000.feffffffffff       no              eth0.2
xenbr0          8000.feffffffffff       no              vif0.0
                                                       peth0

I then setup a domU to act as a gateway between xenbr0 and vlanbr2 in 
domU config like this
vif = [ 'mac=00:16:3E:00:00:26, bridge=xenbr0, 
vifname=gateway.0','mac=00:16:3E:00:02:10, bridge=vlanbr2, 
vifname=gateway.1' ]
and created a couple of other domU's on vlanbr2. To give this.

vlanbr2         8000.feffffffffff       no              eth0.2
                                                       gateway.1
                                                       dom1.0
                                                       dom2.0
xenbr0          8000.feffffffffff       no              vif0.0
                                                       peth0
                                                       gateway.0

At this point i found an issue that anyone on my physical lan could ping 
anything on vlanbr0 simply by creating a vlan on the same network. Which 
i found by removing eth0.2 from vlanbr2 with "brctl delif vlanbr2 
eth0.2" made them unreachable from anything not on the bridge and now 
all traffic going to the vlanbr2 bridge has to be port forwarded through 
the gateway domU. Enabling ip forwarding of course and NAT on the out 
going interface. Don't forget also domU's on the bridge will need to 
know the gateway address to get outside eg.
route add default gw 10.0.0.1 dev eth0

regards
Geoff

Jens Seidel wrote:
> On Thu, Oct 04, 2007 at 04:18:33PM +0200, Heikki Levanto wrote:
>   
> > I have not solved this problem yet, but I found out that the vif-nat way
> > of doing things nicely sidestpes the problem, so suddenly it is not
> > nearly as pressing.
> >     
> I had very similar network problems using Xen 3.1 (my dom0 network did
> no longer worked). In Xen 3.0.3 my dom0 network worked well but I had
> trouble getting an ethernet device in a domU.
>
> Using vif-nat is also my solution ...
>
> Jens
>
> _______________________________________________
> Xen-users mailing list
> Xen-users@xxxxxxxxxxxxxxxxxxx
> http://lists.xensource.com/xen-users
>   
_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users